From d29dcf2fb579433f28bc52411837ca44d0d0e4ba Mon Sep 17 00:00:00 2001 From: Tarik Moussa Date: Sun, 14 Jun 2026 14:55:29 +0200 Subject: [PATCH] fix(mcp): disable DNS rebinding protection for LAN HTTP transport FastMCP defaults to DNS rebinding protection (allowed_hosts=localhost only), which rejects requests from the Mac (192.168.178.82) to the Jetson (192.168.178.103:8765). Security is already provided by Bearer token auth in _TokenAuth middleware and UFW restricting port 8765 to trusted LAN IPs, making host-header validation redundant in this deployment context. Co-Authored-By: Claude Sonnet 4.6 --- codex/mcp_server.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/codex/mcp_server.py b/codex/mcp_server.py index 666c433..1caf294 100644 --- a/codex/mcp_server.py +++ b/codex/mcp_server.py @@ -26,10 +26,16 @@ from __future__ import annotations import logging from mcp.server.fastmcp import FastMCP +from mcp.server.transport_security import TransportSecuritySettings logger = logging.getLogger(__name__) -mcp = FastMCP("codex") +# DNS rebinding protection disabled: the server is guarded by Bearer token auth +# (mcp_server.py _TokenAuth middleware) and UFW firewall (trusted LAN IPs only). +mcp = FastMCP( + "codex", + transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False), +) # ---------------------------------------------------------------------------